Session Management Flaw in Linux Kernel Affecting SMB3 Connections

CVE-2026-99278

What is CVE-2026-99278?

A vulnerability within the Linux kernel's ksmbd subsystem allows clients to establish an unbounded number of valid SMB3 sessions over a single connection. This issue arises from how sessions are counted during authentication processes, leading to potential abuse of session limits. Proper session management is crucial for maintaining network security as this flaw could facilitate unauthorized access under certain conditions. Recent patches have addressed this by introducing a maximum session limit per connection and ensuring proper reservation and deallocation of connection slots during authentication.

References